CVE-2026-9361

MediumCVSS 6.3/10Last modified Jul 23, 2026

Description

A weakness has been identified in Edimax EW-7438RPn 1.12. This affects the function formAccept of the file /goform/formAccep of the component POST Request Handler. This manipulation of the argument submit-url causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: May 24, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-936169.8A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Poin CVE-2026-936177.2Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue af CVE-2026-936186.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks al CVE-2026-93626.3A security vulnerability has been detected in Edimax EW-7438RPn 1.12. This vulnerability affects the function formConnectionSetting of the f CVE-2026-936206.5Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.CVE-2026-936218.2Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.CVE-2026-936227.1Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.CVE-2026-936235.3Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.CVE-2026-936247.2Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.CVE-2026-936275.3An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sen CVE-2026-936285.3An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated send CVE-2026-936295.3An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invi